ElastiCache Redis cluster has automatic failover enabled

Check ID: elasticache_redis_cluster_automatic_failover_enabled
Provider: AWS
Service: elasticache
Severity: MEDIUM
Categories: resilience
Resource type: Other

What this check verifies

Amazon ElastiCache (Redis OSS) replication groups have automatic failover set to enabled, allowing a replica to be promoted when the primary becomes unavailable

Risk

Missing automatic failover reduces availability: a primary or AZ outage can stop writes and require manual recovery, prolonging downtime. As Redis replication is asynchronous, delayed promotion increases chances of lost or stale writes, affecting data integrity and causing client timeouts.

Recommendation

Enable automatic failover with Multi-AZ, keeping at least one replica per shard in a different AZ. Regularly test failover and monitor replication lag. Architect clients for resilience with retries and backoff to tolerate brief role changes, aligning with fault tolerance and defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elasticache modify-replication-group —replication-group-id <example_resource_id> —automatic-failover-enabled —apply-immediately

# Terraform: enable automatic failover for a Redis replication group
resource "aws_elasticache_replication_group" "<example_resource_name>" {
  replication_group_id          = "<example_resource_id>"
  replication_group_description = "<description>"
  node_type                     = "cache.t3.small"
  number_cache_clusters         = 2
  automatic_failover_enabled    = true  # Critical: turns on automatic failover so the check passes
}

# CloudFormation: enable automatic failover for a Redis replication group
Resources:
  <example_resource_name>:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupId: <example_resource_id>
      ReplicationGroupDescription: "<description>"
      NumCacheClusters: 2
      AutomaticFailoverEnabled: true  # Critical: turns on automatic failover so the check passes
      Engine: redis

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elasticache_redis_cluster_automatic_failover_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ElastiCache Redis auto-upgrades minor versions ElastiCache Redis cluster keeps backups for 7 days or more

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires